Is default functions like update_post_meta() safe to use user inputs?
e.g.
update_post_meta(76, 'my_key', $_GET['value'])
Or should I use
$_GET['value'] = sanitize_text_field($_GET['value']);
before using
update_post_meta(76, 'my_key', $_GET['value'])
After upvoting @pieter's answer....
In recent time I came to the realization that it is much better to handle "bad" data gracefully when it is used (usually it means escaping, but also validation) than at input time. Data corruption can happen not only because of some rouge process "shitting" over your data, but also when the enviroment has changed and the data is not as relevant any longer ( a plugin was disabled).
Validation is worth doing if you are going to give some alert to the user, otherwise it might actually be a kind of intermediate state that is hard to protect against and give useful feedback (customizer live changes).
For sanitation, I just use the wordpress APIs for DB access and let them handle that side, but otherwise I feel it is usually waste of time to do anything more then that.
This all depends on context. In your case the question you should ask is whether you even want to sanitize the value, because sanitization means that the value a user request will not be displayed in the same way he wanted it to.
Never leave anything to chance, always sanitize, escape and validate all data coming from forms and super globals like $_GET and $_POST according to your requirements and the data type you are expecting.
It is always good to set your code up in a way so that should your validation fail, you do not unnecessarily run scripts and functions. Have some kind of fail safe which will properly handle failure
